PT-2025-46779 · WordPress · Sureforms

Published 2025-11-13 · Updated 2026-04-07 · CVE-2025-12536

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SureForms plugin for WordPress versions prior to 1.14.0

Description The SureForms plugin for WordPress is susceptible to sensitive information disclosure in versions up to and including 1.13.1. This is a result of the auth callback parameter being set to return true during the registration of the ' srfm email notification' post meta, which permits unauthenticated access to the metadata. Successful exploitation allows unauthenticated attackers to extract sensitive data, including email notification configurations. These configurations often contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that could be exploited to inject malicious data into downstream systems.

Recommendations Update the SureForms plugin to version 1.14.0 or later.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2025-12536

Affected Products

Sureforms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12536 · Security Note
• https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/post-types.php#L892 · Note
• https://twitter.com/VulmonFeeds/status/1988884900133400871 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2041380483662319934 · Twitter Post
• https://t.me/cveNotify/142624 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3391762/sureforms/trunk/inc/post-types.php · Note
• https://twitter.com/CVEnew/status/1988820394221137931 · Twitter Post
• https://t.me/CVEtracker/37206 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9e8e239a-0ddf-479e-b94b-7844ff6e9e81?source=cve · Note